octosentry.git/octosentry, branch 0.5.0macos menu bar app. github security alerts in one feed.
http://git.krz.sh/krz/octosentry.git/atom?h=0.5.02026-07-17T22:12:46+00:00Add mark-seen action, critical-alert badge, and a dedicated window2026-07-17T22:12:46+00:00Christian Cleberghello@cleberg.net2026-07-17T22:12:46+00:00urn:sha1:277e2a7209047ed1514ea7b34034c510a4e51a4f
Closes #8-#10 (milestone 0.5.0).
- Mark-seen: each row gets a checkmark button (separate from the
click-to-open button) that persists the event into seenEventIDs and
removes it from the active stream immediately, no API write.
- Menu bar icon switches to a filled exclamation-shield with a red badge
showing the count of unseen critical alerts when any exist.
- Added a dedicated Window (singleton scene, not WindowGroup — avoids
spawning duplicates) opened via a header button, sharing the exact
same store/authStore instances as the popover. The button hides itself
when already viewing the standalone window.
Replace env-var PAT with GitHub device authorization flow + Keychain2026-07-17T22:04:15+00:00Christian Cleberghello@cleberg.net2026-07-17T22:04:15+00:00urn:sha1:8e6d29f1806cc569b48d913564c7d80a1c2f2355
Closes #6, #7 (milestone 0.4.0).
- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
grant (device code request + poll for token) against GitHub's OAuth
App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
Keychain item (not synced to iCloud Keychain), no shared entitlement
needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
awaitingAuthorization / signedIn) and a new SignInView replaces the
old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
classic OAuth Apps (no read-only variant exists at this level, unlike
fine-grained PATs). Private-repo Dependabot alerts may need broader
repo scope — to be confirmed with real-world testing.
Add persistence, multi-repo watch list, and background polling2026-07-17T21:41:52+00:00Christian Cleberghello@cleberg.net2026-07-17T21:41:52+00:00urn:sha1:2f72d3d0736a6fac306d4e5d9406cb33b08bc2a0
Closes #1-#5 (milestones 0.2.0, 0.3.0).
- Flat JSON persistence (PersistedState/PersistenceStore) in Application
Support, chosen over SwiftData since the dataset is small and the
existing model types are plain Codable value types passed across actor
boundaries.
- Repo watch list, per-event seen-state, and last-fetch timestamps are
now persisted instead of living only in memory.
- Configurable minimum severity filter, applied from a cached raw fetch
so changing it doesn't require a network round-trip.
- Multi-repo support: SecurityEventStore now loops over a persisted watch
list instead of one hardcoded repo, with an in-popover UI (gear button)
to add/remove repos.
- Background polling every 15 minutes, layered on top of the existing
refresh-on-open and manual refresh, so the feed stays fresh even while
the popover is closed.
Scaffold octosentry MVP: unified GitHub security alert feed2026-07-17T21:06:47+00:00Christian Cleberghello@cleberg.net2026-07-17T21:06:47+00:00urn:sha1:d8862a9b78b0d6cf4e11cf537be7678794e08811
MenuBarExtra popover aggregating Dependabot, code scanning, and secret
scanning alerts for a single repo into one severity-ranked stream. Swift 6
strict concurrency, zero third-party dependencies, PAT-via-env-var auth as
a dev-only shortcut ahead of the device authorization flow.